Skip to content

Peering

Now we will begin to setup peerings between our pods. The ISP pods will also setup peering with external transit providers to connect all pods with the Internet. Please use one of the peering templates from below to setup the BGP peerings.

Do not use for production!

These peering templates do not contain any security related hardening. The import all; statement will accept any routes received from a peer. This allows several attacks to pods like intercepting their traffic. Please be kind to your BGP peers until all pods have peerings established in this Internet of trust. After that we can discuss and test potential BGP-based attacks.

You need to get in contact with potential peers (ORG, IXP) and at least two transits (ISP). You need to:

  • get in contact and talk to each other 👋
  • do some legal stuff 💵
  • order your cross connects 🪏
  • agree with your peers who provide the transit networks 🤝
  • configure the peering interfaces (ifstate.yaml)
  • configure the BGP sessions (bird.conf)

A private peering exchanges routes and traffics of two peers. The peering with the route server(s) at an IXP is also a private peering.

protocol bgp ebgp_podX_4 from tpl_bgp {
  neighbor 212.111.xxx.yyy as 645xx;

  ipv4 {
    import all;
    export filter {
      if net_local() then accept;
      reject;
    };
  };
}

protocol bgp ebgp_podX_6 from tpl_bgp {
  neighbor 2a01:7700:8080:xxxx::y as 645xx;

  ipv6 {
    import all;
    export filter {
      if net_local() then accept;
      reject;
    };
  };
}

A private peering exchanges routes and traffics of two peers. ISPs also include their downstream customer networks. The peering with the route server(s) at an IXP is also a private peering.

protocol bgp ebgp_ispXXX_4 from tpl_bgp {
  neighbor 212.111.xxx.yyy as 645xx;

  ipv4 {
    import all;
    export filter {
      if net_local() then accept;
      reject;
    };
  };
}

protocol bgp ebgp_ispXXX_6 from tpl_bgp {
  neighbor 2a01:7700:8080:xxxx::y as 645xx;

  ipv6 {
    import all;
    export filter {
      if net_local() then accept;
      reject;
    };
  };
}

You use iBGP to exchange routes within you network - for example between your border routers. Use your own ASN as the 'neighbor' and be sure to set next hop self, so the instances own IP address is used as the next hop in all of the exported routes.

Set your loopback address as the source address for the IPv6 iBGP.

# connected routes (next hop resolution)
protocol direct {
  interface "*";
  ipv4;
  ipv6;
}

protocol bgp ibgp_bgX_4 from tpl_bgp {
  neighbor 212.111.xxx.yyy as 645xx;

  ipv4 {
    import all;
    export all;
    next hop self;
  };
}

protocol bgp ibgp_bgX_6 from tpl_bgp {
  neighbor 2a01:7700:8080:xxxx::y as 645xx;
  source address 2a01:7700:8080:xxxx::z;

  ipv6 {
    import all;
    export all;
    next hop self;
  };
}